# Navigating The Shadows

## Navigating The Shadows

- [About This Gitbook](https://red.0xbad53c.com/readme.md): Navigating The Shadows contains personal notes on my journey through offensive and defensive security. I write when I have time and feel like it. Sometimes I just drop links to other work.
- [Initial Access](https://red.0xbad53c.com/red-team-operations/initial-access.md): This section describes techniques related to Mitre TA0001 - Initial Access
- [Webshells](https://red.0xbad53c.com/red-team-operations/initial-access/webshells.md): This category talks about webshells. Our aim is usually to load a C2 framework from the webshell or execute other code without spawning suspicious subprocesses from the web server process.
- [Java (JSP) - Bring Your Own Jar](https://red.0xbad53c.com/red-team-operations/initial-access/webshells/java-jsp-bring-your-own-jar.md): On this page, we will explore how to reflectively load a class from a Java library and call its main method. In red team context, this can be used to stage additional java code without touching disk.
- [IIS - SOAP](https://red.0xbad53c.com/red-team-operations/initial-access/webshells/iis-soap.md): This page describes how to run shellcode from a webshell with a .soap extension. Sometimes web applications use upload blacklists and forget about this extension type.
- [Macro Attacks](https://red.0xbad53c.com/red-team-operations/initial-access/macro-attacks.md): This category talks about Office macro attacks, which are often used in combination with phishing to establish a foothold on the victim's machine.
- [Talking Documents with SpVoice COM](https://red.0xbad53c.com/red-team-operations/initial-access/macro-attacks/talking-documents-with-spvoice-com.md): This page describes how to use the Microsoft Speech API to let your office document talk to the end user.
- [Binary File Write via Microsoft Speech API](https://red.0xbad53c.com/red-team-operations/initial-access/macro-attacks/binary-file-write-via-microsoft-speech-api.md): This page describes how to use the Microsoft Speech API to write binary files from office documents.
- [Mark-Of-The-Web Bypass with 7-zip](https://red.0xbad53c.com/red-team-operations/initial-access/macro-attacks/mark-of-the-web-bypass-with-7-zip.md)
- [Azure and O365](https://red.0xbad53c.com/red-team-operations/azure-and-o365.md)
- [PRT Abuse from Userland with Cobalt Strike](https://red.0xbad53c.com/red-team-operations/azure-and-o365/prt-abuse-from-userland-with-cobalt-strike.md): This page describes how to acquire an Azure AD Single Sign-On session from a non-privileged user session on a Windows machine. The acquired token is later used to enumerate Azure AD via ROADTools.
- [Enumerate Azure AD with AzureHound from Userland](https://red.0xbad53c.com/red-team-operations/azure-and-o365/enumerate-azure-ad-with-azurehound-from-userland.md): This page describes how to enumerate Azure AD with AzureHound, starting from a non-privileged user session on a Windows machine.
- [AWS](https://red.0xbad53c.com/red-team-operations/aws.md)
- [Role Abuse: SSM](https://red.0xbad53c.com/red-team-operations/aws/role-abuse-ssm.md): This page describes how a compromised machine with the default AmazonSSMRoleForInstancesQuickSetup role can allow an attacker to move laterally to all other machines holding this role in the VPC.
- [OffSecOps](https://red.0xbad53c.com/red-team-operations/offsecops.md)
- [Arsenal Aggressor Script](https://red.0xbad53c.com/red-team-operations/offsecops/arsenal-aggressor-script.md): Aggressor script to automatically download and load an arsenal of open source and private tooling. Hopefully, this saves other teams time and helps the community!
- [AWS](https://red.0xbad53c.com/red-team-infrastructure/aws.md)
- [Connectionless Ansible Deployment with Terraform via SSM](https://red.0xbad53c.com/red-team-infrastructure/aws/connectionless-ansible-deployment-with-terraform-via-ssm.md): Deploying Ansible playbooks & roles to EC2 instances via Terraform from anywhere without interruption and without accessing SSH.
- [Operational Purple Teaming for Defenders](https://red.0xbad53c.com/training/operational-purple-teaming-for-defenders.md): Cybersecurity Training through Attack Simulation
- [Offensive Security](https://red.0xbad53c.com/training-reviews/offensive-security.md): Personal reviews on Offensive Security courses & certifications.
- [OSED](https://red.0xbad53c.com/training-reviews/offensive-security/osed.md): Offensive Security Exploit Developer
- [RCE In HPE Insight Cluster Management Utility (CVE-2024-13804)](https://red.0xbad53c.com/vulnerability-research/rce-in-hpe-insight-cluster-management-utility-cve-2024-13804.md): I discovered an unauthenticated RCE in HPE CMU in 2023 by weaponising the Java client application against the server. The techniques discussed here, can also be applied to other Java applications.